PT-2026-118063

Vikunja: Unbounded nested task-filter recursion permits API process termination in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

Linux kernel Module Heap Buffer Overflow DoS

The vulnerability of the aareplaceprofiles function in the security/apparmor/policy.c kernel module of the Linux operating system is related to the dereferencing of a pointer with an expired lifetime. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

Linux kernel module daemonize() Buffer Overflow

The vulnerability of the daemonize function in the tools/power/x86/intel-speed-select/isst-daemon.c component of the Linux kernel is related to insufficient resource control during its existence. Exploiting this vulnerability could allow an attacker to compromise the integrity and accessibility o...

Linux kernel BPF Trace Heap Buffer Overflow DoS

The vulnerability of the copyusersyms function in the kernel/trace/bpftrace.c module of the Linux operating system is related to the improper implementation of thread management. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2026-117662

TP-Link Tapo C210 V3.60 contains an authentication bypass vulnerability in the DS JSON API. A crafted JSON request containing both a protected operation and public onboarding-related fields may cause module-level authorization checks to be applied inconsistently, allowing protected camera...

PT-2026-118052

Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint v1 and v2 and escalate to the share's permission level in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mappe...

Malicious code in tailwindcss-effect-lab (npm)

tailwindcss-effect-lab 0.0.0-stage, 1.6.7 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by johnsmith0821 on 2026-10-09. src/motion.js:5 requires the private scope...

MAL-2026-18077 Malicious code in tailwind-animaflow-kit (npm)

tailwind-animaflow-kit 2.0.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by killerdev1127 on 2026-09-28. src/motion.js:5 requires the private scoped package...

openSUSE 16 Security Update : bcel (openSUSE-SU-2026:22109-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22109-1 advisory. - CVE-2026-94114: Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser bsc1284400. - CVE-2026-105111: Class2HTML...

TencentOS Server 3: idm:DL1 (TSSA-2026:1182)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1182 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

MiracleLinux 9 : nodejs:22 (AXSA:2026-2084:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2084:01 advisory. pacote: Pacote: Denial of Service via crafted spec.rawSpec value in addGitSha function CVE-2026-9496 undici: undici: Denial of Service via unrequest...

RockyLinux 8 : gimp:2.8 (RLSA-2026:84744)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:84744 advisory. gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file CVE-2026-90947 gimp: gimp: heap-based buffer overflow in ICO loader v...

AlmaLinux 9.2 [TuxCare] Security Update: openssl / openssl-devel / openssl-libs / openssl-perl Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792414477)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792414477 advisory. - Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do no...

RHEL 10 : perl-URI (RHSA-2026:84587)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:84587 advisory. This module implements the URI class. Objects of this class represent Uniform Resource Identifier references as specified in RFC 2396 and updated b...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Apache HTTP Server vulnerabilities (USN-8931-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8931-1 advisory. discovered that Apache HTTP Server exposed WebDAV property information. A remote...

CentOS Linux 6 [TuxCare] Security Update: kernel / kernel-debug / kernel-debug-devel / kernel-devel / etc Multiple Vulnerabilities (CENTOS6:CLSA-2024:1724774331)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2024:1724774331 advisory. - In the Linux kernel before 5.6.1, drivers/media/usb/gspca/xirlinkcit.c aka the Xirlink camera USB driver mishandles invalid descriptor...

openSUSE 16 Security Update : cadvisor (openSUSE-SU-2026:22117-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:22117-1 advisory. Changes in cadvisor: - update to 0.60.6: workflows: mirror release tags to lib/ module tags fs/zfs: fall back to VFS when zfs stats are unavailable...

Linux Kernel Heap Buffer Overflow DoS

The vulnerability of the radeonringrestore function in the drivers/gpu/drm/radeon/radeonring.c kernel module of the Linux operating system is related to insufficient resource control during its existence. Exploiting this vulnerability could allow an attacker to cause a service failure...

FreeBSD : Erlang/OTP -- erl_tar denial of service via crafted GNU sparse member (37492489-c8f9-11f1-9ceb-4c526214c986)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 37492489-c8f9-11f1-9ceb-4c526214c986 advisory. https://github.com/erlang/otp/security/advisories/GHSA-phm5-m6cj-5382 reports: A loop with unreachable...

AlmaLinux 9 : environment-modules (ALSA-2026:84594)

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:84594 advisory. environment-modules: Command injection in environment-modules Bash completion via malicious module names containing shell metacharacters CVE-2026-85013 Tenable ha...